claims-hyperliquid[.]org

This domain, claims‑hyperliquid.org, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and currently resolves to 172.67.215.234, an address owned by AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are nikon.ns.cloudflare.com and sarah.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and edge services. HTTP requests return status 403 and the page title is “Just a moment…”, while the TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint. Cloudflare Browser Insights and HTTP/3 are observed, confirming modern CDN delivery. The site is classified as a high‑risk brand‑impersonation campaign targeting the Hyperliquid brand and is described as a crypto scam. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, two of ninety‑three VirusTotal scanners flag the domain, and it appears on a single external blocklist. PhishDestroy has already blocked the domain. Because the content behind the title has not been publicly captured, the exact phishing page layout and credential‑stealing mechanisms remain unknown. Defenders should block DNS resolution for claims‑hyperliquid.org, add the IP address 172.67.215.234 to network deny lists, and monitor for any traffic that includes the Cloudflare nameservers nikon.ns.cloudflare.com or sarah.ns.cloudflare.com. Continuous re‑scanning with malware sandboxes and updating intrusion‑prevention signatures is advised to capture any emerging payloads.